CVE-2026-113349
CVE-2026-113349 · OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
CVSS 5.3 · Средний · EPSS 0,3% · Есть исправление
- Опубликовано
- Обновлено
Затронутые продукты и версии
opencats
- Версии
- ≥ 0, < 0.10.0: Затронуто (custom)
Обновитесь до 0.10.0
Первоисточники
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L555-L585
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L690-L712
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/lib/Calendar.php#L83-L150
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-calendar-editevent-deleteevent
- https://nvd.nist.gov/vuln/detail/CVE-2026-113349